TO: 


Of: 


ICO. 


Information Commissioner’s Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


Your Home Improvements Ltd 


78 Southill Road, Parkstone, Poole, Dorset, BH12 3AS 


The Information Commissioner (“the Commissioner”) has decided to 
issue Your Home Improvements Ltd (“YHIL”) with a monetary penalty 
under section 55A of the Data Protection Act 1998 (“DPA”). The penalty 
is being issued because of a serious contravention of regulation 21 of 
the Privacy and Electronic Communications (EC Directive) Regulations 
2003 (“PECR”). 


This notice explains the Commissioner's decision. 


Legal framework 


YHIL, whose registered office is given above (Companies House 
Registration Number: 11028090) is the organisation stated in this 
notice to have used a public electronic communications service for the 
purpose of making unsolicited calls for the purposes of direct marketing 


contrary to regulation 21 of PECR. 


Regulation 21 applies to the making of unsolicited calls for direct 


marketing purposes. It means that if a company wants to make calls 
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promoting a product or service to an individual who has a telephone 
number which is registered with the Telephone Preference Service Ltd 


(“TPS”), then that individual must have given their consent to that 


company to receive such calls. 
Regulation 21 paragraph (1) of PECR provides that: 


“(1) A person shall neither use, nor instigate the use of, a public 
electronic communications service for the purposes of making 


unsolicited calls for direct marketing purposes where- 


(a) the called line is that of a subscriber who has previously 
notified the caller that such calls should not for the time being 


be made on that line; or 


(b) the number allocated to a subscriber in respect of the called 


line is one listed in the register kept under regulation 26.” 
Regulation 21 paragraphs (2), (3), (4) and (5) provide that: 


“(2) A subscriber shall not permit his line to be used in contravention 


of paragraph (1). 


(3) A person shall not be held to have contravened paragraph (1)(b) 
where the number allocated to the called line has been listed on the 
register for less than 28 days preceding that on which the call is 


made. 


(4) Where a subscriber who has caused a number allocated to a line of 
his to be listed in the register kept under regulation 26 has notified 


a caller that he does not, for the time being, object to such calls 
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being made on that line by that caller, such calls may be made by 


that caller on that line, notwithstanding that the number allocated 


to that line is listed in the said register. 


(5) Where a subscriber has given a caller notification pursuant to 


paragraph (4) in relation to a line of his— 


(a) the subscriber shall be free to withdraw that notification at 
any time, and 
(b) where such notification is withdrawn, the caller shall not 


make such calls on that line.” 


Under regulation 26 of PECR, the Commissioner is required to maintain 
a register of numbers allocated to subscribers who have notified them 
that they do not wish, for the time being, to receive unsolicited calls for 
direct marketing purposes on those lines. The Telephone Preference 
Service Limited (“TPS”) is a limited company which operates the 
register on the Commissioner’s behalf. Businesses who wish to carry 
out direct marketing by telephone can subscribe to the TPS for a fee 


and receive from them monthly a list of numbers on that register. 


Section 122(5) of the Data Protection Act 2018 “DPA18” defines direct 
marketing as “the communication (by whatever means) of any 
advertising material which is directed to particular individuals”. This 
definition also applies for the purposes of PECR (see regulation 2(2) 
PECR and paragraphs 430 & 432(6) to Schedule 19 of the DPA18). 


Consent in PECR is defined, from 29 March 2019, by reference to the 
concept of consent in Regulation 2016/679 (“the GDPR”): regulation 
8(2) of the Data Protection, Privacy and Electronic Communications 
(Amendments etc) (EU Exit) Regulations 2019. Article 4(11) of the 
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GDPR sets out the following definition: “'consent’ of the data subject 
means any freely given, specific, informed and unambiguous indication 
of the data subject's wishes by which he or she, by a statement or by a 


Clear affirmative action, signifies agreement to the processing of 


personal data relating to him or her”. 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 

Section 55A of the DPA (as applied to PECR cases by Schedule 1 to 

PECR), as variously amended states the Commissioner may serve a 

person with a monetary penalty notice if the Commissioner is satisfied 

that - 

“(a) there has been a serious contravention of the requirements of the 
Privacy and Electronic Communications (EC Directive) Regulations 
2003 by the person, and 

(b) subsection (2) or (3) applies. 

(2) This subsection applies if the contravention was deliberate. 


(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that 


the contravention would occur, but 


13. 


14. 


LS: 


16. 


Information Commissioner’s Office 


(b) failed to take reasonable steps to prevent the 


contravention.” 


The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR implements Directive 2002/58/EC, and Directive 2009/136/EC 
which amended the earlier Directive. Both the Directive and PECR are 
“designed to protect the privacy of electronic communications users”: 
Leave.EU & Eldon Insurance Services v Information Commissioner 
[2021] UKUT 26 (AAC) at paragraph 26. The Commissioner seeks to 
interpret and apply PECR in a manner consistent with the purpose of 
the Directive and PECR of ensuring a high level of protection of the 
privacy of individuals, and in particular the protections provided from 
receiving unsolicited direct marketing communications which the 


individual has not consented to receive. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the DPA18: see paragraph 58(1) of 
Schedule 20 to the DPA18. 


Background to the case 


YHIL first came to the attention of the Commissioner in August 2020 
when complaints about unsolicited marketing calls from a specific 
calling line identifier (“CLI”) were identified from the monthly reports 


received from the Telephone Preference Service (“TPS”). 
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The Commissioner looked into these complaints as part of a wider 
investigation into growing complaints from individuals about unsolicited 
marketing in relation to white goods maintenance and warranty 


products. The complaints in this case related to boiler cover. 


The Commissioner made enquiries with the relevant Communications 
Service Provider (“CSP”) which confirmed that the CLI in question had 
been allocated to YHIL. They provided detailed call records for the 
period between 1 June 2020 and 31 July 2020 which showed that, over 
that time period, YHIL had made 2,476 calls, of which 1,718 were 
made to individual subscribers whose number had been registered with 
the TPS for not less than 28 days. The Commissioner was able to 
establish that there had been 4 complaints made regarding calls from 
CLI’s attributed to YHIL via the Telephone Preference Service ("TPS"). 


The following are examples of the complaints received by the TPS: 


e “Said I had boiler insurance with them for five years (which I 
definitely do not, and never have had). Very persistent in 
demanding my bank account and sort code to verify who I was. 
Fven offered to take over my laptop remotely to stake (sic) me 
through it.” 


e “Saying my Boiler cover was due to expire. I don't have boiler cover 
with anyone.. I have received several of these calls. They are 
inconvenient and have an old credit card number of mine. And they 


know one of my passwords. (now changed).” 
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e "Said it was about my boiler cover.. Have receiver (sic) quite a few 


calls from this number over the last few weeks. Told them today to 


take my number off their books.” 


e “Each time they have called, it has been a caller with an Asian 
accent. Have requested several times to remove our number from 
list. Reminded them today that as we have requested for our 
number to be removed, by law they have to do this. Also informed 
them that our number is registered on the opt out database and 
they shouldn't be calling us anyway. Names given : XXXX and 
XXXX,” 


The Commissioner sent an initial investigation letter to YHIL on 28 
August 2020, setting out her concerns with YHIL’s PECR compliance 
and asking for details of call volumes and evidence of consent, 


amongst other information. Copy of the complaints were attached. 


On the same day the Commissioner received a telephone call from 
YHIL’s director querying why the letter had been sent. He explained 
that YHIL did not make outbound calls and had not made a sale since 
he purchased the business in 2018. He initially declined to respond to 
the Commissioner's enquiries however, telephoned again later that day 
to ask where he might locate the information required. He was 
informed that he should already hold it in his companies records. The 
director went on to say that he may have information to suggest that 
the calls were made from the Philippines and so he was asked to 
provide this evidence. The director also stated that since the 
government imposed lockdown in March 2020 his staff had been 


making calls from mobile numbers. 
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A written response to the Commissioner's initial investigation letter was 
provided by YHIL on 28 August 2020. This explained that the current 
director had purchased the business in 2018 with the understanding 
that it was a self-sustainable business with an existing customer base, 
and so he had never obtained new customers. The letter indicated that 
sometimes YHIL did receive calls from individuals who believed that 
had been called by the company, however it was assumed that they 
had either contacted the wrong company or were customers of a 


company with a similar name. 


On 3 September 2020 the Commissioner sought further information 
from YHIL in respect of its website, the source of YHIL’s data prior to 
purchase of the business in 2018, including opt-in information and 
privacy policies, any due diligence carried out in relation to data 
providers and consent, any company suppression process and 


confirmation as to any data sharing by YHIL with other companies. 


On 22 September 2020 the Commissioner received contact from 
solicitors acting on behalf of YHIL. A meeting was held on 25 
September 2020 whereby the Commissioner explained the basis of the 
investigation and reiterating the information she required. This was 


followed up by a written request on the same day. 


A response was received on 29 September 2020 which stated: 

“Mr XXXX [director] would like to make clear that he has not at any 
stage given authority to any third parties to make marketing calls on 
behalf of Your Home Improvements Ltd and neither did he make the 
calls personally. He is unable to offer an explanation for the 
provenance of the calls, other than the telephone records you have 


already seen. 
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He does not conduct marketing for this business and neither does he 


hold client contact lists that would enable him to do so. Given this, Mr 


XXXX has not sought consent to make marketing calls.” 


Neither YHIL nor its solicitors confirmed whether YHIL shares its data 


with any other business. 


An end of investigation letter was sent by the Commissioner to YHIL on 
5 October 2020. 


The Commissioner is satisfied, based on evidence from complainants, 
that the YHIL calls were all made for the purposes of direct marketing 
as defined by section 122(5) DPA 18. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute a 
contravention of regulation 21 of PECR by YHIL and, if so, whether the 


conditions of section 55A DPA are satisfied. 


The contravention 


The Commissioner finds that YHIL contravened regulation 21 of PECR. 


The Commissioner finds that the contravention was as follows: 


Between 1 June 2020 and 31 July 2020, YHIL used a public 
telecommunications service for the purposes of making 1,718 
unsolicited calls for direct marketing purposes to subscribers where the 


number allocated to the subscriber in respect of the called line was a 
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number listed on the register of numbers kept by the Commissioner in 
accordance with regulation 26, contrary to regulation 21(1)(b) of PECR. 


This resulted in 4 complaints being made to the TPS and the 


Commissioner. 


The Commissioner is also satisfied for the purposes of regulation 21 
that these 1,718 unsolicited direct marketing calls were made to 
subscribers who had registered with the TPS at least 28 days prior to 
receiving the calls, and they had not given their prior consent to YHIL 


to receive calls. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 


Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because there have been multiple breaches 
of regulation 21 by YHIL arising from the organisation’s activities over 
a two month period, and this led to a substantial number of unsolicited 
direct marketing calls being made to subscribers who were registered 
with the TPS, and a number of complaints being made as a result. 
Furthermore, YHIL has been unable to provide any explanation for the 
calls nor demonstrate it held valid consent for the purpose of these 


calls. 


The percentage of calls made to TPS registered individuals is significant 


— in this case 69% of all the calls made. 


This investigation was undertaken during a wider operation to combat 


targeting of vulnerable individuals by organisations selling white goods 
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maintenance and warranty products. The risk of detriment to 
individuals who are targeted in this way is high, as demonstrated by 


the complaints received. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A (1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 
above was deliberate. In the Commissioner's view, this means that 
YHIL’s actions which constituted that contravention were deliberate 
actions (even if YHIL did not actually intend thereby to contravene 
PECR). 


The Commissioner does not consider that YHIL deliberately set out to 


contravene PECR in this instance. 


The Commissioner has gone on to consider whether the contravention 
identified above was negligent. This consideration comprises two 


elements: 


Firstly, she has considered whether YHIL knew or ought reasonably to 
have known that there was a risk that this contravention would occur. 


She is satisfied that this condition is met. 


YHIL's director purchased the business in 2018 with an existing 
customer base and so should have been aware that contraventions of 


this type may occur. 


The Commissioner has published detailed guidance for companies 
carrying out marketing explaining their legal requirements under PECR. 
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This guidance explains the circumstances under which organisations 
are able to carry out marketing over the phone, by text, by email, by 
post or by fax. Specifically, it states that live calls must not be made to 
subscribers who have told an organisation that they do not want to 


receive calls; or to any number registered with the TPS, unless the 


Subscriber has specifically consented to receive calls. 


Standard practice of the TPS is to contact the organisation making the 
calls on each occasion a complaint is made. It is therefore reasonable 
to believe that YHIL would have received a notification from the TPS for 
each of the complaints being made in this case which should have 
made YHIL aware of the risk that such contraventions may occur, and 


were indeed occurring. 


It is therefore reasonable to suppose that YHIL should have been 


aware of its responsibilities in this area. 


Secondly, the Commissioner has gone on to consider whether YHIL 
failed to take reasonable steps to prevent the contravention. Again, she 


is satisfied that this condition is met. 


YHIL could not evidence that it carried out any or any adequate due 
diligence upon purchase of the business, and seemingly took no steps 
to ascertain the source of the data utilised or ensure that it had 
consent to make the calls. It neglected to ensure that the data had 
been screened against the TPS every 28 days as required. These are 
basic requirements for any organisations conducting a live direct 
marketing campaign. The director is unable to provide any explanation 
for the calls which would suggest a general lack of awareness of how 


the business is operating. 
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Reasonable steps in these circumstances may have included 
familiarising itself with the relevant legislation surrounding direct 
marketing, ensuring that it could evidence that individuals had 
specifically consented to receiving calls from YHIL; screening the data 
it intended to rely on against the TPS register itself, and ensuring an 
effective suppression system was in place for individuals who did not 


wish to be contacted. 


It is clear that YHIL failed to take those reasonable steps. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


The Commissioner's decision to impose a monetary penalty 


The Commissioner has taken into account the following aggravating 


features of this case: 


Whilst there was no evidence of direct targeting of vulnerable 
individuals, the Commissioner noted that complainants mentioned 
persistence of calls for products which they had never had, in one 
instance going so far as offering to take control over a laptop remotely. 
It is also concerning that complaints evidence that YHIL were seeking 
financial information including sort codes and account numbers which, 
given the company’s approach, poses a high risk of inadvertent 


disclosure or fraud; 


The actions of YHIL were carried out to generate business and to increase 
profits, gaining an unfair advantage on those businesses complying with 
the PECR; 
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The Commissioner produces clear guidance via its website on the rules 
of direct marketing. She also operates a helpline should organisations 
be unsure and require further clarification. The Commissioner has 
previously taken openly publicised regulatory action against other 
organisations within the same sector and it is therefore reasonable to 
expect informed awareness of PECR within the industry in which YHIL 


operate; 


YHIL failed to co-operate with the Commissioner's investigation, initially 
declining to do so until the prospect of being served with an Information 
Notice. Even then, and despite having utilised the services of a solicitor, 
YHIL was unable to provide adequate answers to the Commissioner’s 


enquiries or evidence consent to make the calls; 


YHIL’s director acknowledged that calls were made by staff using mobile 
telephones, however the ICO is unable to verify the extent to which such 
calls were made. Therefore the true extent of the contravention is 


indeterminable. 


The Commissioner considers that there are no mitigating factors to 


consider in this case. 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A(1) DPA have been met in this case. She is 
also satisfied that the procedural rights under section 55B have been 


complied with. 
This has included issuing a Notice of Intent on 19 July 2021, in which 


the Commissioner set out her preliminary thinking, and invited YHIL to 


make representations in response. 
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Whilst YHIL acknowledged receipt of the Notice of Intent, it has not 


made any representations to the Commissioner. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 


The Commissioner has considered whether, in the circumstances, she 
should exercise her discretion so as to issue a monetary penalty. She 
has decided that a monetary penalty is an appropriate and 
proportionate response to the finding of a serious contravention of 
Regulation 21 of PECR by YHIL. 


The Commissioner's underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls is a matter of significant public 
concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. This is an opportunity 
to reinforce the need for businesses to ensure that they are only 


telephoning consumers who want to receive these calls. 


The Commissioner has also considered the likely impact of a monetary 
penalty on YHIL on the basis of the information available to her, and in 


the absence of any financial representations from YHIL. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that the amount of the penalty is £20,000 (Twenty thousand 


pounds). 
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Conclusion 


The monetary penalty must be paid to the Commissioner's office by BACS 
transfer or cheque by 19 October 2021 at the latest. The monetary 
penalty is not kept by the Commissioner but will be paid into the 
Consolidated Fund which is the Government’s general bank account at the 


Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 18 
October 2021 the Commissioner will reduce the monetary penalty by 
20% to £16,000 (Sixteen thousand pounds). However, you should be 
aware that the early payment discount is not available if you decide to 


exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 


a) the imposition of the monetary penalty 


and/or; 


b) the amount of the penalty specified in the monetary penalty notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 


Information about appeals is set out in Annex 1. 


68. The Commissioner will not take action to enforce a monetary penalty 


unless: 
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e the period specified within the notice within which a monetary penalty 


must be paid has expired and all or any of the monetary penalty has not 


been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e period for appealing against the monetary penalty and any variation of it 


has expired. 


69. In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner 
as an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 20th day of September 2021 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person 
upon whom a monetary penalty notice has been served a right of 
appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 


against the notice. 
2. If you decide to appeal and if the Tribunal considers:- 


a) that the notice against which the appeal is brought is 


not in accordance with the law; or 


b) to the extent that the notice involved an exercise of 
discretion by the Commissioner, that she ought to have exercised 


her discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the 


Tribunal at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LE1 8DJ 
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Telephone: 0203 936 8963 
Email: grc@justice.gov.uk 


a) The notice of appeal should be sent so it is received by 


the Tribunal within 28 days of the date of the notice. 

b) If your notice of appeal is late the Tribunal will not 
admit it unless the Tribunal has extended the time for complying 
with this rule. 


4. The notice of appeal should state:- 


a) your name and address/name and address of your 


representative (if any); 


b) an address where documents may be sent or delivered to 


you, 


C) the name and address of the Information Commissioner; 


d) details of the decision to which the proceedings relate; 
e) the result that you are seeking; 

f) the grounds on which you rely; 

g) you must provide with the notice of appeal a copy of 


the monetary penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above 


the notice of appeal must include a request for an extension of 
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time and the reason why the notice of appeal was not provided in 


time. 


5. Before deciding whether or not to appeal you may wish to consult 
your solicitor or another adviser. At the hearing of an appeal a party 
may conduct his case himself or may be represented by any person 


whom he may appoint for that purpose. 


6. The statutory provisions concerning appeals to the First-tier 
Tribunal (Information Rights) are contained in section 55B(5) of, and 
Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure 
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009 
(Statutory Instrument 2009 No. 1976 (L.20)). 
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